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Support for ‘adequacy plus’ decision of the UK 


An agreement on data protection will be crucial for the EU and the UK, and any disruption to 
cross-border data flows would be costly to all partners. An agreement will also ensure clarity 
on enforcing citizens’ rights. 


The UK Direct Marketing Association Managing Director, Rachel Aldighieri said: “The free flow 
of data allows businesses across the EU and UK to perform a great many functions. For 
instance, a company based in Italy that uses one of the UK’s many server host companies to 
store information about its customers would have to go through the complicated process of 
moving its data operations to the EU. Given the number of businesses in the UK that process 
EU citizens’ data, the effects of stopping data flows could be huge." 


All trade is increasingly reliant on data flows and especially so in Europe. For example, many 
EU organisations use service providers based in the UK and a major disruption of data flows 
would cause legal uncertainty for companies using UK service providers and vice versa. It is in 
the interests of both sides to do all they can to minimise disruption. 


The UK is proposing a new agreement between the EU and UK, building on standard 
adequacy, that would better deliver on the EU and UK’s shared interests. This deal would 
reflect the UK’s deep alignment on this issue. 


The deal aims to: 


e Maintain the free flow of personal data between the UK and EU 
e Minimise legal uncertainty for UK and EU businesses 

e Reassure citizens that their data is safe in both the UK and EU 

e Not impose unnecessary costs on businesses 

e Provide for on-going regulatory cooperation 


Regulatory cooperation is particularly important as this will give businesses legal certainty and 
allow the EU to benefit from the expertise of the Information Commissioner’s Office (ICO), 
which is the UK’s data protection authority. 


The ICO has taken a leading role within the EU, as a member of the Article 29 Working Party, 
they were responsible for over 50% of the working party’s guidelines in 2017. Aside from 
Ireland, the UK is the only other native English speaking country, the lingua franca of the EU, 
and so their contribution has been even more valuable. A continued role for the ICO on the 
European Data Protection Board (EDPB) after Brexit will bring it the benefits of the ICO’s 
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expertise, resources, experience and global influence. The ICO is the EU’s most well-resourced 
regulator. 


This new deal would make it easier for EU consumers to complain about a UK organisation 
and therefore protect citizen’s rights. 


A continued role for the ICO on the EDPB is in both the interests of businesses based in the 
EU and UK, as well as maintaining the free flow of data. 


This case study here under highlights some of the challenges that the industry would face: 
Case study: UK-based cloud computing service provider 


Let’s say cloud computing service provider A is a UK-based company. They store a multitude 
of data for a number of large corporations throughout the world. Insurance company B is 
based in Germany and has used provider A to store data about their customers for 5 years. 
For this contract to be legal, both organisations must be compliant with GDPR rules in regards 
to processing personal data of European citizens. If the UK were to leave the EU, at the very 
least, an adequacy agreement would be required to ensure the UK conformed to regulation 
under GDPR. The UK would need to be deemed to be a safe place to store data by European 
regulators. If there was no immediate adequacy agreement, it would be illegal for Insurance 
company B to store the data of their clients on the UK-based servers of provider A. The 
insurance company would be obligated to store the data safely, and thus have to move their 
data to a provider which complied with GDPR laws. The insurance company then face the 
complicated task of moving their entire database from one country to another, coupled with 
the associated costs. While provider A would lose a client. 


For further information: If you have any questions, email UK DMA external affairs manager, 


Zach Thornton: zach.thornton@dma.org.uk. 


FEDMA stands for 22 national Direct Marketing Associations, representing more than 5 000 
organisations, and members, representing all parts of the value chain in the direct marketing 
industry. The direct marketing industry uses information and personal data to effectively 
match customers’ needs with relevant brand offers. The industry allows organisations to 
target customers (both prospective and existing) with a personalised message, to generate 
sales both online and in store in a cost-effective way to build long-lasting relationships with 
customers and raise brand awareness. It is an essential driving force of the EU economy and 
the EU Digital Single Market. 
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